Asterisk - Memory Leak Vulnerability
Summary
DLA-1225-1: asterisk - security update. Affects asterisk versions < 1:1.8.13.1~dfsg1-3+deb7u8. Fixed in 1:1.8.13.1~dfsg1-3+deb7u8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Asterisk is an open source PBX and telephony toolkit that provides functionality for creating communication applications. It supports various protocols and can be used to build voice, video, and messaging applications. However, a vulnerability has been discovered in Asterisk that can lead to resource exhaustion and denial of service.
Vulnerability Detail
The vulnerability, identified as CVE-2017-17090, is a memory leak issue in the chan_skinny (SCCP protocol) channel driver of Asterisk. When flooded with certain requests, the chan_skinny driver can cause the Asterisk process to consume excessive virtual memory, eventually leading to the inability to process any requests. To mitigate this vulnerability, the chan_skinny driver has been updated to release memory allocations correctly, preventing exhaustion.
How To Fix
Minimum fixed version
1:1.8.13.1~dfsg1-3+deb7u8
This is the first release that contains the fix.
sudo apt-get install --only-upgrade asteriskTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The memory leak vulnerability in Asterisk's chan_skinny driver can lead to resource exhaustion and denial of service. It is crucial to upgrade the Asterisk package to the recommended version to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for asterisk →
FAQ
Asterisk is an open source PBX and telephony toolkit used for building communication applications.
The vulnerability can result in resource exhaustion and denial of service, causing Asterisk to stop processing any requests.
The vulnerability affects Asterisk version 1:1.8.13.1~dfsg1-3+deb7u7 and earlier.
To fix the vulnerability, upgrade the Asterisk package to version 1:1.8.13.1~dfsg1-3+deb7u8 or later.
More information about Debian LTS security advisories, including how to apply updates and frequently asked questions, can be found at https://wiki.debian.org/LTS.
Related vulnerabilities
Recent vulnerabilities recorded for asterisk.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
